Privacy Policy

When an organisation uses Dune, the plans, documents and figures in its workspace belong to that organisation. We process them on its behalf and on its instructions, as its processor. Requests about that data are best sent to the organisation; if they reach us, we pass them on.

We decide how account, security and support data is used, and we run the Brand Research datasets described below. For those, we are the controller.

About the people who use Dune: name, work email address, organisation and role; sign-in and security records; a log of actions taken in the application (who approved a plan, who changed a line, who exported a report); settings such as notification preferences and theme; messages and comments; conversations with Dune Now; and problem reports sent from inside Dune, which can include a screenshot of the page.

Campaign and business information: plans, budgets, documents such as booking orders, purchase orders and invoices, and delivery figures. This is mostly commercial information about organisations, though documents can name individual contacts. It is protected with the same controls.

Figures from connected platforms and public information for Brand Research, both described below.

A user with permission can connect an organisation's Meta Ads, Google Ads, Google Analytics 4 or Shopify account. Each connection is authorised by that user on the platform's own sign-in screen, and can be removed at any time. A Dune Direct workspace can also connect TikTok and Snapchat ad accounts, as described below.

Dune reads:

• account, campaign and ad set names and identifiers, with each campaign's status, type or objective, budget and dates, and the account's currency and time zone;
• daily spend, impressions, clicks, video views, conversions and conversion value from Meta Ads and Google Ads, with reach and frequency from Meta Ads and search impression share from Google Ads;
• from TikTok and Snapchat, in a Dune Direct workspace, each campaign's daily spend, impressions, clicks (swipes on Snapchat), video views, purchases and purchase value, with reach and frequency;
• daily purchase revenue and transaction counts from Google Analytics 4;
• from Shopify, each order's date, currency, shipping country and line items (product code, quantity and amounts), which Dune adds up into daily revenue totals by product and market.

Dune does not store order-level, customer-level or audience-level records: Shopify orders are added up as they are read and are not kept. Google's permission for Google Ads covers both reading and managing campaigns, because Google offers no read-only version. Dune uses it to read results and, only in a Dune Direct workspace, to launch the campaigns a member asks for, as described below.

A Dune Direct workspace can also launch ads on Meta. Its owner connects a Meta ad account, a Facebook Page and, optionally, the Page's Instagram account. When a member of the workspace confirms a launch, Dune uploads the images and videos they chose from their creative library to that ad account and creates the campaign, ad set and ads they reviewed, paused; nothing runs until they activate it. Dune keeps the identifiers, statuses and review results Meta reports for those objects, and a log of each request it sent to Meta and Meta's answer, so the workspace has a record of what was done on its account. It only pauses, resumes or deletes what it created, and only when a member asks.

A Dune Direct workspace can launch Google Search ads the same way. Its owner connects a Google Ads account, and the manager account it is reached through where there is one. When a member confirms a launch, Dune first asks Google to check the campaign without creating anything, then creates the campaign, its budget, the places and languages it targets, the ad group, the keywords and the responsive search ad they reviewed, paused; nothing runs until they activate it. Dune keeps the identifiers, statuses and review results Google reports for those objects, and a log of each request it sent to Google and Google's answer. It only pauses, resumes or removes what it created, and only when a member asks. Disconnecting Google Ads in Dune revokes Dune's access at Google.

A Dune Direct workspace can launch ads on TikTok as well. Its owner signs in with TikTok for Business and chooses an advertiser account and the TikTok identity the ads appear under. When a member of the workspace confirms a launch, Dune checks the account's status, currency, balance, identity and pixel, uploads the videos and cover images they chose from their creative library to that account, and creates the campaign, ad group and ads they reviewed, paused; nothing runs until they activate it. A campaign that aims at website purchases uses the account's TikTok pixel. Dune keeps the identifiers, statuses and review results TikTok reports for those objects, and a log of each request it sent to TikTok and TikTok's answer. It only pauses, resumes or deletes what it created, and only when a member asks. Dune also reads the daily results of the account's campaigns, listed above. Disconnecting TikTok in Dune revokes Dune's access at TikTok.

A Dune Direct workspace can launch ads on Snapchat the same way. Its owner signs in with Snapchat and chooses an organisation, an ad account and the brand's Public Profile the ads appear under. When a member confirms a launch, Dune checks the account's status, currency, payment method, profile and pixel, uploads the images and videos they chose to that account, and creates the creatives, campaign, ad squad and ads they reviewed, paused; nothing runs until they activate it. A campaign that aims at sales uses the account's Snap Pixel. Dune keeps the identifiers, statuses and review results Snapchat reports for those objects, and a log of each request it sent to Snapchat and Snapchat's answer. It only pauses, resumes or deletes what it created, and only when a member asks. Dune also reads the daily results of the account's campaigns, listed above. Disconnecting Snapchat in Dune deletes the access Dune stored, so Dune can no longer reach the account.

A workspace that records store bookings and sales in Dune can choose to send them to its own Google Ads account, so Google can report and optimise on them. Its team chooses the Google Ads account and the conversion actions in Dune's Commerce settings. For each booking or purchase, Dune sends the conversion action, the time, the value and currency, and the Google click ID from the ad click. Dune can also include the shopper's email address and phone number, hashed with SHA-256 before they leave Dune, so Google receives no readable contact details; Google uses them only where the advertiser has accepted its enhanced conversions terms. Dune keeps Google's request ID and processing status for each send, and shows the team whether Google accepted it. Nothing is sent until the team sets this up, and they can pause or remove it at any time.

The same workspace can choose to send its bookings and sales to its own Meta, TikTok or Snapchat account, through each platform's conversions interface. Its team adds the Meta dataset, TikTok event set or Snapchat pixel in Dune's Commerce settings, with an access token it creates on that platform; Dune encrypts the token before storage. For each booking, enquiry or purchase (Snapchat receives bookings and purchases), Dune sends the kind of event, the time, the value and currency, the product codes and quantities, an event ID that lets the platform discard duplicates, and the booking reference hashed with SHA-256. Where the shopper arrived from an ad, Dune also sends what was recorded on that visit, as each platform accepts it: the platform's click ID (Meta's click and browser IDs, TikTok's click ID or Snapchat's click ID), the page they landed on, and the IP address and browser of the visit. Dune keeps each platform's reply for each send and shows the team whether it was accepted. Nothing is sent until the team sets this up, and they can pause it at any time.

On every platform, Google included, a booking, enquiry or sale is sent only when the shopper agreed to measurement when they booked or bought, and nothing more is sent once they withdraw that agreement. The shopper's email address and phone number go with it only where Meridian has turned on contact matching for that advertiser, and always hashed with SHA-256 before they leave Dune, so no platform receives readable contact details. Otherwise no contact details are sent.

The figures are used to show an organisation its delivery and results against its plan: pacing, return on ad spend, reports, dashboards and answers from Dune Now. When a user asks Dune Now a question, or Dune writes commentary on an organisation's results or suggests which plan line a platform campaign belongs to, the relevant figures are sent to our AI provider to produce that answer, commentary or suggestion for that organisation. They are never used to train AI models.

Platform data is never sold, never used to target or personalise advertising, and never shared with anyone other than the service providers listed below that help run Dune. Access credentials are encrypted before storage, with keys held outside the database, and are never shown to any user.

Dune is adding lead forms. Once they are available, an advertiser will be able to connect the lead forms it runs on Meta, Google, TikTok and Snapchat. When a person submits one of those forms, Dune will receive the answers they gave on it, such as their name, email address and phone number, with the ad, ad set and campaign the form came from. Dune will record the lead against the line in the advertiser's plan that bought the ad, so the advertiser sees how many leads each line produced and which went on to book or buy.

Leads will be shown only to the advertiser's own team. Dune will not contact the people who submit a form, and will never sell or share leads, or use them to target advertising or to train AI models. Contact details will be encrypted before storage and kept for the period the advertiser sets, then deleted. Disconnecting a Page or account will stop Dune receiving its leads.

Dune is adding conversations that start from ads. Once they are available, an advertiser will be able to connect its WhatsApp Business number, its Facebook Page and the Instagram professional account linked to that Page. When someone messages the advertiser after tapping one of its ads, the platform will notify Dune of the message, with the referral it attaches: which ad the conversation came from and, on WhatsApp, the click ID. Dune will receive the sender's identifier on that platform: their WhatsApp number, or the identifier Meta assigns them for that Page or Instagram account.

Dune will use this to count the conversation against the line in the advertiser's plan that bought the ad, and to connect it to a booking or sale that follows. It will keep only what it needs for that: the sender's identifier, encrypted before storage, the ad the conversation came from and when it started, for the period the advertiser sets. On WhatsApp, Dune will also send the messages the advertiser sets up, such as a booking confirmation, from the advertiser's own number using templates WhatsApp has approved. Dune will not send messages on Messenger or Instagram, and will never use messages for advertising or to train AI models. A conversation will be sent back to an ad platform only under the consent rule described above. Disconnecting the number, Page or account will stop Dune receiving its messages.

Dune accesses Google user data only after a user connects a Google account on Google's own consent screen, and only to provide the features described above.

What Dune accesses. With the Google Ads permission: the account, campaign and ad group details and the daily results listed above, and, in a Dune Direct workspace, the campaigns Dune launched with their review status. With the Data Manager permission: the processing status of the conversions Dune sent; nothing else is read through it. With the Google Analytics permission: daily purchase revenue and transaction counts and, once available, key events and revenue by campaign, as described below.

Google Analytics by campaign (coming soon). Dune is adding results by campaign from Google Analytics 4. Once available, for each day and campaign Dune will read the number of each key event the property records, such as a form sent or a purchase, and the revenue, so the advertiser can compare them with the plan line that bought the campaign. These are daily totals: Dune does not read data about individual visitors.

How Dune uses it. To show the organisation that connected the account its delivery and results against its plan, to launch and manage the campaigns its members ask for, to send the conversions its team set up to its own Google Ads account, and to produce answers and commentary on its own results.

Who it is shared with. Only the service providers that host and run Dune, listed below, our AI provider (Anthropic) to produce an answer, commentary or suggestion for that organisation, and Google itself when Dune sends conversions to the organisation's own account. Google user data is never sold, never transferred to data brokers or information resellers, never used to target, retarget or personalise advertising, never used to decide creditworthiness or for lending, and never used to develop, improve or train generalised AI or machine-learning models, by us or by our AI provider.

How it is protected. Data is encrypted in transit. Google access tokens are encrypted with AES-256 before storage, with keys held outside the database, and are never shown to any user. Every record is scoped to its organisation at the database level, so no other organisation can read it.

How long it is kept. Figures from a Google connection are kept until the connection is removed, when they are deleted; in a Dune Direct workspace, until the workspace is deleted. Records of the campaigns Dune launched and the conversions it sent are kept with the organisation's campaign records and erased with them. You can ask us to delete any of it sooner, as described in the next section.

Meridian staff do not read Google user data except with the user's permission, where needed for security, to comply with the law, or in aggregated and anonymised form to run the service.

Dune's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Removing a connection from an organisation's connection settings immediately deletes the stored credentials and every figure synced through that connection.

To also withdraw Dune's access on the platform's side:

• Meta: remove Dune under Business Integrations in your Facebook settings.
• Google: disconnecting Google Ads under Ad accounts in a Dune Direct workspace already revokes Dune's access at Google. You can also remove Dune from the third-party connections in your Google Account.
• TikTok: disconnecting TikTok in a Dune Direct workspace already revokes Dune's access at TikTok.
• Shopify: uninstall the custom app you created for Dune in your store admin.

In a Dune Direct workspace, disconnecting the Meta ad account, the Google Ads account or the TikTok account withdraws Dune's access on that platform and deletes the stored credentials; disconnecting Snapchat deletes the stored credentials. The workspace keeps its records of the ads it launched, the conversions it sent and the figures already received, until the workspace itself is deleted. Campaigns already running keep running on the platform.

If you remove Dune in your Facebook settings, or ask Meta to have Dune delete your data, Dune deletes your access credentials, your Meta user identifier and the permissions you granted from every connection made with your login, and gives you a confirmation code and a page where you can check the request's status. The workspace's own records of the ads it launched stay with the workspace.

You can also email privacy@meridiansystems.io to ask us to delete data received from any connected platform. We confirm once it is done.

Brand Research shows organisations how their brand and its competitors appear in public. It is built from public information:

• ads published in public ad libraries, such as Meta's Ad Library and Google's Ads Transparency Center, and on YouTube;
• brands' own public profiles and posts on social platforms such as Instagram, TikTok, X and Snapchat;
• a sample of public comments on those posts, and of public posts and news articles that mention a brand;
• search interest over time;
• the answers AI assistants give to questions about product categories. We send these services questions about categories and brands, never personal data;
• photographs of billboards taken from public roads.

Where this information comes from individuals, we keep as little as we can. The person who wrote a comment or post is never stored by name: their account identifier is replaced with a coded value that cannot be reversed without a key we hold. Comments are counted and summarised, never shown to customers. A public post that mentions a brand can be shown as a short excerpt with a link to the post, without its author's name. The text of comments and posts, and the coded value, are deleted after 12 months.

Anyone who holds rights in an ad or post can have it hidden and blocked from further collection using the form on our crawler page. To have comments or posts you wrote erased, email privacy@meridiansystems.io.

• To run the service: signing users in, showing each organisation only its own data, producing plans, reports and exports, sending the notification emails a user has chosen, and keeping an audit trail of changes.
• To keep Dune secure, and to find and fix problems, including those reported from inside Dune.
• To provide support when an organisation asks for it.

We do not sell personal data, and we do not use it for advertising or profiling.

Dune uses AI models to read documents, suggest matches between invoices or platform campaigns and plan lines, write commentary, analyse Brand Research, and answer questions in Dune Now. Suggestions that would change a record are saved only when a person confirms them.

Dune Now answers questions about the organisation's own data. Conversations are kept in the user's history until they delete them. Our AI provider processes this data only to return a response, and we do not use customer data to train AI models.

Dune relies on a small number of providers, each handling data only to deliver the service: Supabase (database, sign-in and file storage), Vercel (application hosting), Anthropic (the AI features described above), Resend (email), Sentry (error monitoring) and Mapbox (maps).

Brand Research also uses official platform interfaces and specialist data-collection providers to gather the public information described above, and questions AI assistants for its research. None of them receives personal data about Dune's users or customers. A current list of providers is available on request.

Dune's database and application run in London, in the United Kingdom. Some of the providers above are based in the United States and may process data there. Where personal data moves between countries, we rely on the protections that data protection laws allow, including contractual commitments from each provider.

• Campaign and financial records: seven years by default, reflecting the commercial and tax retention expectations for advertising records. Deleted records are withdrawn from all views straight away and permanently erased once that period ends.
• Accounts: when someone's access ends, their account is deactivated. Their name stays on the actions they took, so the organisation's audit trail stays accurate, and can be erased on request unless the law requires us to keep it.
• Figures from a connected platform: until the connection is removed, when they are deleted; in a Dune Direct workspace, until the workspace is deleted.
• Records of the ads Dune launched and the conversions it sent to a platform: kept with the campaign records above.
• Dune Now conversations: until the user deletes them.
• Comment and post text collected for Brand Research: 12 months.

Depending on where you live, including under the data protection laws of the United Arab Emirates and Saudi Arabia, you can ask for a copy of the personal data held about you, ask for it to be corrected or erased, object to or restrict how it is used, and withdraw any consent you have given. Dune implements export and erasure directly, so these requests are fulfilled from the running system rather than reconstructed by hand.

To make a request, email privacy@meridiansystems.io. We respond within 30 days. If the data sits in an organisation's workspace, we pass the request to that organisation, which decides on it.

If your booking, purchase, lead or message reached Dune through an advertiser, you can ask that advertiser, or us at privacy@meridiansystems.io, for a copy of the data held about you or for it to be erased; the request is handled in Dune, and erasure also stops anything about you still waiting to be sent to an ad platform.

If you are unhappy with how we have handled your data, you can complain to the data protection authority where you live: in the United Arab Emirates, the UAE Data Office; in Saudi Arabia, the Saudi Data & AI Authority (SDAIA).

Dune uses only the cookies it needs to work: one that keeps you signed in, a short-lived security cookie while you connect a platform, and cookies that remember interface preferences such as the colour theme. It does not use advertising or analytics cookies, and nothing tracks you across other sites.

Every record is scoped to its owning organisation at the database level, so one organisation's data cannot be read by another even if the application were to ask for it. Access is role-based, transport is encrypted, platform credentials are encrypted at rest with keys held outside the database, and access to production data is limited and logged.

Meridian support staff can view an organisation's workspace in read-only mode, only when the organisation asks for help or to investigate a security problem. Each view is time-limited, cannot change anything, and is logged.

Dune is a business service and is not intended for anyone under 18.

If this policy changes materially we will update the date above and, where the change affects how personal data is used, notify account holders by email.

Meridian Systems L.L.C-FZ
Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.
privacy@meridiansystems.io
This policy is governed by the laws of the United Arab Emirates.